Business owners need to be aware of the dangers posed by this malware, especially combined with the appeal of credit card information. Malware like that used in the LastPass attacks is a growing threat to consumers and businesses. Updating IAM users and keys, including deleting unnecessary users.Adding logging and alerting in cloud storage.Revoking and then re-issuing certificates the threat actor likely obtained.

Rotating credentials the threat actor likely had access to.

Investigating resources with forensic imaging.

Improving the DevOps engineer’s home security.

LastPass has taken several notable steps to prevent similar incidents in the future, including: With that access, the threat actor exported the vault entries and shared folder content, including encrypted content and decryption keys. This provided access to the engineer’s corporate vault at LastPass. The threat actor targeted the engineer’s home computer using a vulnerable third-party media package and a keylogger. To access those keys, the second attack targeted a DevOps engineer with access to the decryption keys. They did not have access to the decryption keys, which were only available in a handful of places. Some LastPass credentials that the threat actor stole in the first attack were encrypted. Simply put, the threat actor needed information from the second attack to use the data gathered in the first attack. The two incidents were not seen as related until LastPass began investigating the second attack.

The threat actor ended the original attack on Aug. By learning more about the attack, business owners can strengthen their own security weaknesses. LastPass recently revealed more details of the second malware attack targeting its infrastructure.It also disclosed the company’s actions to prevent similar attacks in the future.

Lastpass backup vault